Land #43, @alynn71's OpenVMS NTP, POP and SSH improvements

rapid7 · Mar 25, 2015 · ad23a16 · ad23a16
2 parents f7b7928 + 1191d43
commit ad23a16
Show file tree

Hide file tree

Showing 4 changed files with 55 additions and 3 deletions.
diff --git a/lib/recog/version.rb b/lib/recog/version.rb
@@ -1,3 +1,3 @@
 module Recog
-  VERSION = '1.0.23'
+  VERSION = '1.0.24'
 end
diff --git a/xml/ntp_banners.xml b/xml/ntp_banners.xml
@@ -791,7 +791,7 @@ NTP "banners", taken from a readvar response
     </example>
     <param pos="0" name="service.family" value="NTP"/>
     <param pos="0" name="service.product" value="NTP"/>
-    <param pos="0" name="os.vendor" value="OpenVMS"/>
+    <param pos="0" name="os.vendor" value="HP"/>
     <param pos="0" name="os.product" value="OpenVMS"/>
     <param pos="1" name="service.version"/>
     <param pos="2" name="os.arch"/>

diff --git a/xml/pop_banners.xml b/xml/pop_banners.xml
@@ -225,6 +225,21 @@ matched against these patterns to fingerprint POP3 servers.
       <param pos="0" name="os.certainty" value="0.5"/>
    </fingerprint>
 
+   <fingerprint pattern="^TCPIP POP server V\d\.\d\S-\S{3}, OpenVMS V(\d\.\d-\d)(?:\s+\S+)?\s+at\s+(\S+), .*$">
+      <description>TCP/IP Services for OpenVMS POP server</description>
+      <example os.version="7.3-2" host.name="example.com">TCPIP POP server V5.4J-15A, OpenVMS V7.3-2 Alpha at example.com, up since 2015-02-12 08:44:53 20400434.2</example>
+      <!--V5.4J-15A refers to TCP/IP Services for OpenVMS version-->
+      <param pos="0" name="service.family" value="OpenVMS"/>
+      <param pos="0" name="service.product" value="TCPIP POP server"/>
+      <param pos="0" name="service.vendor" value="HP"/>
+      <param pos="0" name="os.vendor" value="HP"/>
+      <param pos="0" name="os.family" value="OpenVMS"/>
+      <param pos="0" name="os.product" value="OpenVMS"/>
+      <param pos="0" name="os.device" value="General"/>
+      <param pos="1" name="os.version"/>
+      <param pos="2" name="host.name"/>
+   </fingerprint>
+
 <!--
 
 ; Mandrake 8.1 - uses UW IMAP

diff --git a/xml/ssh_banners.xml b/xml/ssh_banners.xml
@@ -777,7 +777,7 @@ fingerprint SSH servers.
       <param pos="0" name="os.family" value="Windows"/>
       <param pos="0" name="os.product" value="Windows"/>
    </fingerprint>
-   
+
    <fingerprint pattern="^Comware-(\d+\.?\d*\.?\d*)$">
       <description>SSH on H3C Comware</description>
       <example os.version="5.20.105">Comware-5.20.105</example>
@@ -789,6 +789,43 @@ fingerprint SSH servers.
       <param pos="0" name="os.family" value="Comware"/>
       <param pos="1" name="os.version"/>
    </fingerprint>
+
+   <fingerprint pattern="^(\d\.\d+\.\d+) SSH Secure Shell OpenVMS V\d\.\d$">
+      <description>SSH for OpenVMS </description>
+      <example service.component.version="3.2.0">3.2.0 SSH Secure Shell OpenVMS V5.5</example>
+      <!--V5.5 refers to TCP/IP Services for OpenVMS version -->
+      <param pos="1" name="service.component.version"/>
+      <param pos="0" name="service.component.vendor" value="SSH Communication Security"/>
+      <param pos="0" name="service.component.family" value="SSH Secure Shell"/>
+      <param pos="0" name="service.component.product" value="SSH Secure Shell"/>
+      <param pos="0" name="service.vendor" value="HP"/>
+      <param pos="0" name="service.family" value="OpenVMS"/>
+      <param pos="0" name="service.product" value="SSH Server"/>
+      <param pos="0" name="os.vendor" value="HP"/>
+      <param pos="0" name="os.device" value="General"/>
+      <param pos="0" name="os.family" value="OpenVMS"/>
+      <param pos="0" name="os.certainty" value="0.75"/>
+   </fingerprint>
+
+   <fingerprint pattern="^(\d\.\d+\.\d+) SSH (?:Secure Shell )?OpenVMS V\d\.\d VMS_sftp_version (\d)$">
+      <description>SSH for OpenVMS sftp</description>
+      <example service.component.version="3.2.0" service.version="3">3.2.0 SSH Secure Shell OpenVMS V5.5 VMS_sftp_version 3</example>
+      <example service.component.version="3.2.0" service.version="3">3.2.0 SSH OpenVMS V5.5 VMS_sftp_version 3</example>
+      <!--V5.5 refers to TCP/IP Services for OpenVMS version -->
+      <param pos="1" name="service.component.version"/>
+      <param pos="0" name="service.component.vendor" value="SSH Communication Security"/>
+      <param pos="0" name="service.component.family" value="SSH Secure Shell"/>
+      <param pos="0" name="service.component.product" value="SSH Secure Shell"/>
+      <param pos="0" name="service.vendor" value="HP"/>
+      <param pos="0" name="service.family" value="OpenVMS"/>
+      <param pos="0" name="service.product" value="VMS SFTP Server"/>
+      <param pos="2" name="service.version"/>
+      <param pos="0" name="os.vendor" value="HP"/>
+      <param pos="0" name="os.device" value="General"/>
+      <param pos="0" name="os.family" value="OpenVMS"/>
+      <param pos="0" name="os.certainty" value="0.75"/>
+   </fingerprint>
+
 <!--
 1.2.22j4rad
 2.40